The vulnerability in Devtron’s Attributes API allows any authenticated user to retrieve the global API Token signing key via /orchestrator/attributes?key=apiTokenSecret. With the key attackers can forge JWTs for arbitrary identities offline, granting them full control over the Devtron platform and enabling lateral movement into the underlying Kubernetes cluster. This flaw is a classic example of insufficient authorization checks (CWE-862).

The issue affects Devtron versions 2.0.0 and earlier deployed on Kubernetes environments. The affected product is the Devtron application platform, as listed by the CNA vendor devtron-labs. No additional product variants are implicated by the current data.

Overall severity is high with a CVSS score of 8.7, but the EPSS score is less than 1 % and the vulnerability is not yet in the CISA KEV catalog, indicating a relatively low probability of exploitation in the wild. Exploitation requires only standard authentication to Devtron, so low‑privileged CI/CD developers can trigger the endpoint. Once the signing key is stolen, attackers can impersonate any user, creating a complete loss of confidentiality, integrity, and availability for the entire platform.